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STS-114: Engine Cut-Off Sensors Are a No-Go 


Launch Rationale 

Review of exhaustive engineering analysis led the Mission 
Management Team (MMT) to a safety of flight rationale 
that three of the four sensors reading normal would be 
acceptable for launch. All hardware related to the failure 
had been replaced and retested. All orbiter hardware was 
thoroughly tested and no anomalies were noted. 

Additionally, the team was confident in their decision 
because, as former Associate Chief Engineer John 
Cipolleti points out, “When we were doing this 
investigation, we actually got the engineer who designed 
the box out of retirement to come and consult with us and 
we chatted with him. He was very forthright in saying that 
when he designed the system he knew if there was a single 
failure during a launch attempt, you wouldn’t be able to 
fix it. So he put four [sensors] in so one was a ground 
throw away and for flight you only needed three [1].” 

While a total of four sensors protect against a low-level 
cut-off, only two are required for space shuttle main 
engine (SSME) shutdown. For a failure of these two 
sensors to impact flight operations, a hydrogen leak large 

enough to require a low-level cut-off and a third sensor failure would have to occur [5, p.3 1 ]. Engineers 
also noted that signals from engine cut-off (ECO) sensors 1 and 2 go through different connectors than 
ECO-3 and ECO-4. While all four sensors go through the same point sensor board (PSB), each sensor 
has its own independent circuitry inside the box [5, p.32]. Multiple other systems were also in place to 
protect the SSMEs even if the ECO sensors failed. Through this rationale, the MMT approved a 
conditional Launch Commit Criteria (LCC) that would permit launch with 3-of-4 functional ECO circuits 



Fig. I. The flames of Space Shuttle Discovery’s 
Solid Rocket Boosters are reflected in the water 
next to Launch Pad 39B as the Shuttle leaps from 
the pad on the historic Return to Flight mission 
STS-114 [3], 
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given certain conditions [4, p.5]. So as Robert Kichak 1 described it, “With every opinion, point of view, 
and doubt fully expressed and openly debated” [2], the final decision to launch Shuttle Discovery was 
approved for July 26, 2005. 


Post-Countdown 


On July 26, the countdown for STS-1 14 was flawless and liftoff occurred on time. There were no more 
issues with ECO sensors throughout the duration of the mission. Both the Discovery vehicle and its crew 
returned to Earth safely on August 9, 2005 at Edwards Air Force Base, California. It is important to note, 
however, intermittent anomalies related to the engine cut-off sensors continued to occur after mission 
STS-1 14. Multiple initial launch attempts were scrubbed due 
to failed ECO sensors during pre-launch countdown, 
including those of missions STS-1 21 and STS-1 15 in 2006. 

Nevertheless, by implementing hardware upgrades, including 
new wiring, enhancing monitoring capability, and relaxing 
the LCC requirement, the Shuttle fleet was allowed to 
continue flying in spite of these unexplained failures [4, p.l]. 

In fact, the root cause was not determined until STS- 122 in 
December 2007 - more than two years after the ECO sensor 
anomaly was first investigated. 


Several launch attempts in which the anomalies were 
repeated led to successful detection of the problem area. As 
Robert Kichak points out, “Ultimately the cause of the 
problems was conclusively determined to be in the external 
tank cryogenic feed-through connector. We were finally 
fortunate enough to have the problem occur and persist with 
the extra instrumentation in place to determine exactly where 
it was happening,” [2]. Due to the use of time domain 
reflectometry (TDR) installed during a December 2007 
tanking test, the team was capable of pinpointing an open 
circuit should it recur. ECO-2 and ECO-3 exhibited erratic 
behavior during testing while ECO-1 failed wet about 25-30 
minutes after sensors were initially wetted. An open circuit 
was indicated somewhere outside of the PSB according to 
the ECO voltages. TDR equipment was then plugged into 
staged break points and the open circuits were isolated to the 
area of the feed-through connector [4], Open circuits in the 
feed-through plate, the part that connects wires from the 
interior to the exterior of the liquid hydrogen tank, were 
identified as the culprit causing false readings during launch 



Fig. 2: Soldered pins/ sockets [4], 



Fig. 3: Modified feed-through connector [6|. 


1 Served as the National Engineering and Safety Center (NESC) Discipline Engineer for Avionics; co-author of "STS-1 14 Engine 
Cut-off Sensor Anomaly Technical Consultation Report” 
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attempts and tanking tests. Modifications were made to solder the external harness sockets and the feed- 
through pins of these connectors together. Once subjected to temperature, pressure, and vibration 
environments identical to those experienced during a Shuttle launch, the new configuration was verified 
as adequate and led to successful performance thereafter. 
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